Detection rules › Falco
Create Disallowed Pod
Detect an attempt to start a pod with a container image outside of a list of allowed images.
Telemetry coverage
| Platform | Record / event type |
|---|---|
| Kubernetes | create-pods: create pods |
Rules detecting the same action
These rules filter on the same operation.
- Attach/Exec Pod (Falco)
- Azure AKS Attempted User Exec into Pod (Elastic)
- Container With A hostPath Mount Created (Sigma)
- Create HostIPC Pod (Falco)
- Create HostNetwork Pod (Falco)
- Create HostPid Pod (Falco)
- Create Privileged Pod (Falco)
- Create Sensitive Mount Pod (Falco)
Stages and Predicates
Stage 1: falco_condition
and
jevt.rawtime is_null
objectRef.resource eq "pods"
objectRef.subresource is_null
stage eq "ResponseComplete"
verb eq "create"
Indicators
These rows show field, operator, and value matches.
| Field | Kind | Values | Search |
|---|---|---|---|
jevt.rawtime | is_null | field:"jevt.rawtime" kind:is_null | |
objectRef.resource | eq |
| field:"objectRef.resource" kind:eq value:"pods" |
objectRef.subresource | is_null | field:"objectRef.subresource" kind:is_null | |
stage | in |
| field:"stage" kind:in value:"ResponseComplete" |
verb | eq |
| field:"verb" kind:eq value:"create" |